CVE-2022-29166

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

matrix-appservice-irc is a Node.js IRC bridge for Matrix. The vulnerability in node-irc allows an attacker to manipulate a Matrix user into executing IRC commands by having them reply to a maliciously crafted message. The vulnerability has been patched in matrix-appservice-irc 0.33.2. Refrain from replying to messages from untrusted participants in IRC-bridged Matrix rooms. There are no known workarounds for this issue.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74

Affected software

No affected versions have been published.

Timeline

Published: May 5, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-291677.5Hawk is an HTTP authentication scheme providing mechanisms for making authenticated HTTP requests with partial cryptographic verification of CVE-2022-291686.1Wire is a secure messaging application. Wire is vulnerable to arbitrary HTML and Javascript execution via insufficient escaping when renderi CVE-2022-291697.5BigBlueButton is an open source web conferencing system. Versions starting with 2.2 and prior to 2.3.19, 2.4.7, and 2.5.0-beta.2 are vulnera CVE-2022-291708.5Grafana is an open-source platform for monitoring and observability. In Grafana Enterprise, the Request security feature allows list allows CVE-2022-291717.2Sourcegraph is a fast and featureful code search and navigation engine. Versions before 3.38.0 are vulnerable to Remote Code Execution in th CVE-2022-291726.1Auth0 is an authentication broker that supports both social and enterprise identity providers, including Active Directory, LDAP, Google Apps CVE-2022-291738.8go-tuf is a Go implementation of The Update Framework (TUF). go-tuf does not correctly implement the client workflow for updating the metada CVE-2022-291748.1countly-server is the server-side part of Countly, a product analytics solution. Prior to versions 22.03.7 and 21.11.4, a malicious actor wh CVE-2022-291767.5Rubygems is a package registry used to supply software for the Ruby language ecosystem. Due to a bug in the yank action, it was possible for CVE-2022-291775.9Go Ethereum is the official Golang implementation of the Ethereum protocol. Prior to version 1.10.17, a vulnerable node, if configured to us CVE-2022-291788.2Cilium is open source software for providing and securing network connectivity and loadbalancing between application workloads. Cilium prior CVE-2022-291798.2Cilium is open source software for providing and securing network connectivity and loadbalancing between application workloads. Prior to ver